PT-2022-5388 · Siemens +1 · 6Ag1206-2Bb00-7Ac2 Firmware +159

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to the improper authorization of the change password function in the web interface. This could allow low-privileged users to escala...

FortiAnalyzer & FortiManager - improper authorization to template image

An exposure of resource to wrong sphere vulnerability CWE-668 in FortiAnalyzer and FortiManager GUI may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path...

CVE-2022-39873

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

CVE-2022-39873

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

Authorization

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

CVE-2022-39873

CVE-2022-39873 affects Samsung Internet (pre-18.0.4.14). The root cause is improper authorization, enabling a physical attacker to add bookmarks in Secret/Private mode without user authentication. The vulnerability impacts Samsung Internet on affected devices powered by versions before 18.0.4.14....

CVE-2022-39873

Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user authentication...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SMR Sep-2022 Release 1 version for Android R11 and 3.3.03.66 version for Android S12, which...

CVE-2022-39862

CVE-2022-39862 affects Samsung Mobile devices running Android R (11) and Android S (12) with the Dynamic Lockscreen. The vulnerability is due to improper authorization of the dynamic lockscreen javascript interface API, enabling unauthorized use. Affected versions include SMR Sep-2022 Release 1 f...

Improper Authorization

github.com/goharbor/harbor is vulnerable to improper authorization. A remote authenticated attacker is able to revoke the permissions or impersonate a robot account due to improper validation of the user permissions when updating the robot account through the vulnerable updateV2Robot function...

Improper Authorization

github.com/goharbor/harbor is vulnerable to improper authorization. A remote authenticated attacker is able to gain access to unauthorized projects due to improper validation of the user permissions when updating tag immutability policies...

Microsoft Windows Active Directory Certificate Services Improper Authorization Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Microsoft Windows Active Directory Certificate Services. Authentication is required to exploit this vulnerability. The specific flaw exists within the issuance of certificates. By including...

CVE-2022-32169 bytebase - Improper Authorization

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”...

CVE-2022-32169 bytebase - Improper Authorization

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”...

CVE-2022-32170 bytebase - Improper Authorization

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=$userId”...

CVE-2022-32170 bytebase - Improper Authorization

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=$userId”...

The vulnerability of the centralized Subversion version control system, related to improper authorization, allows a violator to gain access to confidential data.

The vulnerability of the centralized version control system Subversion is related to improper authorization. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data...

GHSA-JGC8-GVCX-9VFX XWiki Platform Improper Authorization check for inactive users

Impact Some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service: so a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default: so an inactive...

Full Account Takeover via Improper Authorization

Description Immich does not check for admin privileges when setting account passwords. This allows any user to set the password for any account, thus allowing privilege escalation by admin account takeover. Proof of Concept Steps to reproduce: 1. Login to a non admin account 2. Obtain all user...

GHSA-GGF6-638M-VQMG Netmaker vulnerable to Insufficient Granularity of Access Control

Impact Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API. In addition, differing response cod...